Splunk® at GoodData

Increased Operational Visibility to Support Business Growth

The Business

In the age of big data when companies analyze streams of data for business intelligence (BI), trending, forecasting and predictive modeling, GoodData offers a cloud solution that eliminates the on-premises need to deploy and maintain complex data warehousing and analyses resources and delivers intuitive, front-end data discovery. With over 275 employees worldwide, the San Francisco-based firm is the only vendor on Gartner's Magic Quadrant to offer an end-to-end cloud-based BI and analytics solution. Customers gain competitive advantages by uploading billions of rows of data to GoodData's solution for rapid analysis, knowledge and insight.


As it prepared to launch its BI platform, GoodData required comprehensive, realtime views of its cloud infrastructure to maintain reliable performance, meet its SLAs and ensure customer satisfaction. Its development and operations staffs needed their own operational analytics to seamlessly coordinate their work and present themselves to customers as a unified team that quickly updates, tests and implements new services and functionality. GoodData's DevOps staff must know when any systems are faltering and rapidly identify causes before customers are impacted.

To track the many moving parts in its platform, GoodData captures logs from each component and service. Gleaning information from those logs, however, was tedious. When a service was disrupted, troubleshooting was brutally slow and often manual. GoodData considered developing its own log indexer, but found that doing so would divert the resources of its small staff. To offer the business value demanded by its customers, GoodData needed to extract its own intelligence easily and in real time.

Enter Splunk

For operational analytics, GoodData considered two solutions. The first, grep tools, enabled event log monitoring for network and security management. The alternative was Splunk Enterprise, which a staffer had discovered online. GoodData evaluated both and found that the Splunk software immediately indexed and parsed the company's logs into data that was quickly visualized in GoodData dashboards for analysis. The grep tools solution, on the other hand, required further development and enhancement before they could satisfy GoodData's needs.

GoodData deployed Splunk Enterprise in 2009 just as its own platform began accepting data from its first customers. From the beginning, the Splunk solution has been critical to the firm's operations by providing the agility to feed dashboards without coding or scripts. To this day, the company continues to periodically evaluate solutions and consistently finds that Splunk Enterprise extracts intelligence from its logs more effectively than other methods. Moreover, Splunk eliminates the need for GoodData to develop its own proprietary log indexer, particularly because the solution's scalability keeps pace with the company's rapid growth.

“Splunk Enterprise was rapidly adopted throughout GoodData because of its flexibility and ease of use," says the team leader for GoodData's technical support. "Our developers and engineers were able to fill dashboards and start conducting analysis without a steep learning curve due to understanding the underlying log structures. Without Splunk software, we would have needed to hire two engineers to do the same work.“


Monitoring and oversight protects business value

As a provider of analytics as a service, GoodData uses Splunk Enterprise to monitor its underlying infrastructure, including servers, applications and application level events like user creation, data mart provisioning and data uploads. The main data sources for the Splunk indexers are log and debug files generated by the firm's platform, its operating system and other internal systems, as well as data from third parties like Salesforce.

Seven GoodData teams, including DevOps, security, quality assurance, and technical and customer support, track usage trends and optics in services and application delivery. By extracting insight from logs and other data sources, the teams oversee the health of all constituent systems.

“Splunk software is where we get our own business and IT intelligence," says the team leader. "Daily, we assess how well our solution meets our customers' BI needs. Splunk-powered dashboards are prominently displayed in our offices so everyone, from executive leadership and down, can view the internal workings of our platform.“

Providing an additional measure of security

An additional use case for Splunk software is indexing logs of security events. This capability provides historical data for auditors and helps GoodData meet its SOC Type 2 compliance requirements for internal controls as a service organization. When a threat arises, the organization's security team turns to the logs to better understand the potential problem.

Improving application development and testing

To remain competitive, GoodData regularly updates and refines its platform, which Gartner cited as one of the firm's "particular advantages.1" By doing so, the company's DevOps teams continually improve the quality and value of their services.

The development team codes and tests applications and uses Splunk software to help fine-tune them, assess their stability and evaluate their impact on other components within their service. Operations personnel maintain services levels by relying on the Splunk solution to track upgrades and releases when they are placed into production, again monitoring the environment for possible issues post-deployment.

“Our Splunk-powered GoodData dashboards radiate information across our DevOps teams to help them build and release new software effectively and quickly," explains the team leader. "To further optimize visibility into how well new features perform, we even design them to issue logs directly to Splunk Enterprise.“

Ensuring quality of service

Splunk Enterprise is GoodData's primary tool for verifying that services meet customers' expectations. The solution monitors component thresholds to determine if systems are over-taxed and to reveal exceptional behavior that could degrade performance and lead to disruptions. The "Managed Services" team, for example, monitors ETL (extract, transform and load) subsystems and customers' scheduled data uploads, which can number hundreds of thousands per day, for errors, performance trends and completion times. GoodData processes over 2.2 million data integrations per week.

GoodData's IT teams have configured the Splunk platform to issue alerts for 150 instances of pre-defined component behaviors. Thanks to this early warning system, the company can diagnose problems quickly and proactively address potential issues.

“Splunk Enterprise is our first line of defense against slowdowns and outages that might undermine our customers' faith in GoodData," says the team leader. "It's our main troubleshooting system for our DevOps and support teams.“